based on the default config it is IDS not IPS. IPS can be accomplished by using the configuration I posted earlier with copy to parameters. You will see IPS mode in the logs if successful.
I believe I am having iptables issues with my guest network. So if not using a guest network or would be willing to test please do share what you find.
I am testing your latest IPS "config" and I do have a desktop on a guest wifi network. I started a ping from that desktop to 8.8.8.8 and then restarted suricata with your settings. Here is the output of my suricata log. My desktop never lost the ping connection, but I do get an error in the log. The alert shown is my Govee unit that monitors temp/humidity in my outside music room.
Aug 5 08:33:59 RT-AC86U suricata: 5/8/2020 -- 08:33:59 - <Notice> - This is Suricata version 4.1.8 RELEASE
Aug 5 08:33:59 RT-AC86U suricata: 5/8/2020 -- 08:33:59 - <Info> - CPUs/cores online: 2
Aug 5 08:33:59 RT-AC86U suricata: 5/8/2020 -- 08:33:59 - <Info> - Found an MTU of 1500 for 'eth0'
Aug 5 08:33:59 RT-AC86U suricata: 5/8/2020 -- 08:33:59 - <Info> - Found an MTU of 1500 for 'eth0'
Aug 5 08:33:59 RT-AC86U suricata: 5/8/2020 -- 08:33:59 - <Info> - Found an MTU of 1500 for 'br0'
Aug 5 08:33:59 RT-AC86U suricata: 5/8/2020 -- 08:33:59 - <Info> - Found an MTU of 1500 for 'br0'
Aug 5 08:33:59 RT-AC86U suricata: 5/8/2020 -- 08:33:59 - <Info> - AF_PACKET: Setting IPS mode
Aug 5 08:33:59 RT-AC86U suricata: 5/8/2020 -- 08:33:59 - <Info> - fast output device (regular) initialized: fast.log
Aug 5 08:33:59 RT-AC86U suricata: 5/8/2020 -- 08:33:59 - <Info> - stats output device (regular) initialized: stats.log
Aug 5 08:33:59 RT-AC86U suricata[10202]: 5/8/2020 -- 08:33:59 - <Info> - Syslog output initialized
Aug 5 08:33:59 RT-AC86U suricata[10202]: 5/8/2020 -- 08:33:59 - <Info> - 20 rule files processed. 3117 rules successfully loaded, 0 rules failed
Aug 5 08:33:59 RT-AC86U suricata[10202]: 5/8/2020 -- 08:33:59 - <Info> - Threshold config parsed: 0 rule(s) found
Aug 5 08:33:59 RT-AC86U suricata[10202]: 5/8/2020 -- 08:33:59 - <Info> - 3117 signatures processed. 223 are IP-only rules, 567 are inspecting packet payload, 2466 inspect application layer, 0 are decoder event only
Aug 5 08:34:03 RT-AC86U suricata[10202]: 5/8/2020 -- 08:34:03 - <Info> - Using 2 live device(s).
Aug 5 08:34:03 RT-AC86U suricata[10202]: 5/8/2020 -- 08:34:03 - <Info> - AF_PACKET IPS mode activated eth0->br0
Aug 5 08:34:04 RT-AC86U suricata[10202]: 5/8/2020 -- 08:34:04 - <Info> - AF_PACKET IPS mode activated br0->eth0
Aug 5 08:34:04 RT-AC86U suricata[10202]: 5/8/2020 -- 08:34:04 - <Info> - Found an MTU of 1500 for 'br0'
Aug 5 08:34:04 RT-AC86U suricata[10202]: 5/8/2020 -- 08:34:04 - <Info> - Found an MTU of 1500 for 'eth0'
Aug 5 08:34:04 RT-AC86U suricata[10202]: 5/8/2020 -- 08:34:04 - <Info> - Found an MTU of 1500 for 'br0'
Aug 5 08:34:04 RT-AC86U suricata[10202]: 5/8/2020 -- 08:34:04 - <Info> - Found an MTU of 1500 for 'eth0'
Aug 5 08:34:04 RT-AC86U suricata[10202]: 5/8/2020 -- 08:34:04 - <Notice> - all 7 packet processing threads, 2 management threads initialized, engine started.
Aug 5 08:34:04 RT-AC86U suricata[10202]: 5/8/2020 -- 08:34:04 - <Info> - All AFP capture threads are running.
Aug 5 08:34:41 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:16794 -> 18.233.186.252:80
Aug 5 08:35:00 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:2591 -> 18.233.186.252:80
Aug 5 08:35:41 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:23452 -> 18.233.186.252:80
Aug 5 08:35:46 RT-AC86U suricata[10202]: 5/8/2020 -- 08:35:46 - <Warning> - [ERRCODE: SC_ERR_SOCKET(200)] - Sending packet failed on socket 7: Message too long
Aug 5 08:35:46 RT-AC86U suricata[10202]: 5/8/2020 -- 08:35:46 - <Warning> - [ERRCODE: SC_ERR_SOCKET(200)] - Sending packet failed on socket 7: Message too long
Aug 5 08:35:58 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:2087 -> 18.233.186.252:80
Aug 5 08:36:41 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:14805 -> 18.233.186.252:80
Aug 5 08:36:56 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:14532 -> 18.233.186.252:80
Aug 5 08:37:41 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:2591 -> 18.233.186.252:80
Aug 5 08:37:55 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:12015 -> 18.233.186.252:80
Aug 5 08:38:41 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:9270 -> 18.233.186.252:80
Aug 5 08:38:53 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:32175 -> 18.233.186.252:80
Aug 5 08:39:41 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:1405 -> 18.233.186.252:80
Aug 5 08:39:51 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:2591 -> 18.233.186.252:80
Aug 5 08:40:41 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:27847 -> 18.233.186.252:80
Aug 5 08:40:50 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:26661 -> 18.233.186.252:80
Aug 5 08:41:41 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:2002 -> 18.233.186.252:80
Aug 5 08:41:45 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.201:38259 -> 192.230.66.121:80
Aug 5 08:41:48 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:6530 -> 18.233.186.252:80
Aug 5 08:42:41 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:2591 -> 18.233.186.252:80
Aug 5 08:42:46 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:28714 -> 18.233.186.252:80
Aug 5 08:43:41 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:30688 -> 18.233.186.252:80
Aug 5 08:43:45 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:1385 -> 18.233.186.252:80
Aug 5 08:44:41 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:32430 -> 18.233.186.252:80
Aug 5 08:44:43 RT-AC86U suricata[10202]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:2591 -> 18.233.186.252:80